# US 2019/0245871 A1 · Network device owner identification and communication triggering system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0245871 A1 - Document ID: US20190245871A1 - Status: Published application - Kind: A1 - Application number: 15/889,944 - Filed: 2018-02-06 - Published: 2019-08-08 - Earliest claimed: 2018-02-06 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Julia A. Ward; Michael Jacob Richardson; Mackenzie Smith Durnovich; Scott Brow; Jessica Kay Aleshire - Web page: https://patentgrep.com/patent/US20190245871A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Embodiments of the present invention provide a system for network device owner identification and communication triggering. In particular, the system may monitor a plurality of systems of record associated with network of devices and/or individual network components. A primary user for each of these network components is identified, either through a known association in the systems of record or from analysis of records of network traffic associated with each network component. The primary user is recorded for each network component. In the event a vulnerability of a network component is identified, information about the network vulnerability is identified, aggregated with other information about the network component and potential remediation procedures, and compiled as a vulnerability notification. In response to the vulnerability, the system is automatically triggered to transmit the vulnerability notification to the primary user. ## Claims ### Claim 1 A system for network component owner identification and communication triggering, the system comprising: a memory device; and one or more processing devices operatively coupled to the memory device, wherein the one or more processing devices are configured to execute computer-readable program code to: monitor a plurality of systems of record associated with a network of devices; identify, from the monitored plurality of systems of record, a primary user of a network component; record a linkage between the primary user, communication information for the primary user, and the network component in an ownership database; determine that a vulnerability of the network component is occurring; and in response to determining that the vulnerability of the network component is occurring, automatically transmit a notification of the vulnerability to a computing device of the primary user. ### Claim 2 (depends on 1) The system of claim 1, wherein identifying the primary user of the network component comprises: determining that the primary user cannot be identified in a primary system of record; determining that the primary user cannot be identified in secondary systems of record; analyzing network traffic to the network component to identify a plurality of users that have accessed the network component during a predetermined period of time; identifying, from the plurality of users, a first user that either (i) most recently accessed the network component or (ii) accessed the network component a greater number of times than any others of the plurality of users; and assigning the first user as the primary user of the network component. ### Claim 3 (depends on 2) The system of claim 2, wherein identifying the plurality of users comprises identifying a set of users associated with login credentials that were entered during the predetermined period of time. ### Claim 4 (depends on 2) The system of claim 2, wherein identifying the plurality of users comprises identifying a set of users that own a plurality of separate devices that communicated with the network component during the predetermined period of time. ### Claim 5 (depends on 1) The system of claim 1, wherein identifying the primary user of the network component comprises determining a correlation value between the network component and a user associated with the network component, wherein the correlation value is based on ownership correlation criteria of (i) administrator-type actions taken on the network component, (ii) high frequency of accessing the network component, (iii) high duration of accessing the network component, and (iv) a lack of other users that are associated with the network component. ### Claim 6 (depends on 1) The system of claim 1, wherein the one or more processing devices are further configured to execute computer-readable program code to: identify vulnerability information for the vulnerability of the network component comprising at least a vulnerability classification, a remediation deadline, and a lifecycle of the vulnerability, wherein the notification of the vulnerability includes the vulnerability information. ### Claim 7 (depends on 6) The system of claim 6, wherein identifying the vulnerability information for the vulnerability of the network component comprises comparing the vulnerability to a vulnerability database to identify the vulnerability classification, the remediation deadline, and the lifecycle of the vulnerability. ### Claim 8 (depends on 1) The system of claim 1, wherein the one or more processing devices are further configured to execute computer-readable program code to: determine whether a remediation procedure has been initiated; and when the remediation procedure has not been initiated, transmit a second notification to the computing device of the primary user; or when the remediation procedure has not been initiated, transmit a request to the computing device of the primary user for confirmation that the remediation procedure will be completed by a remediation deadline. ### Claim 9 (depends on 1) The system of claim 1, wherein the computing device of the primary user is not the network component. ### Claim 10 A computer program product for network component owner identification and communication triggering, the computer program product comprising at least one non-transitory computer readable medium comprising computer readable instructions, the instructions comprising instructions for: monitoring a plurality of systems of record associated with a network of devices; identifying, from the monitored plurality of systems of record, a primary user of a network component; recording a linkage between the primary user, communication information for the primary user, and the network component in an ownership database; determining that a vulnerability of the network component is occurring; and in response to determining that the vulnerability of the network component is occurring, automatically transmitting a notification of the vulnerability to a computing device of the primary user. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein identifying the primary user of the network component comprises: determining that the primary user cannot be identified in a primary system of record; determining that the primary user cannot be identified in secondary systems of record; analyzing network traffic to the network component to identify a plurality of users that have accessed the network component during a predetermined period of time; identifying, from the plurality of users, a first user that either (i) most recently accessed the network component or (ii) accessed the network component a greater number of times than any others of the plurality of users; and assigning the first user as the primary user of the network component. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein identifying the plurality of users comprises identifying a set of users associated with login credentials that were entered during the predetermined period of time. ### Claim 13 (depends on 11) The computer program product of claim 11, wherein identifying the plurality of users comprises identifying a set of users that own a plurality of separate devices that communicated with the network component during the predetermined period of time. ### Claim 14 (depends on 10) The computer program product of claim 10, wherein identifying the primary user of the network component comprises determining a correlation value between the network component and a user associated with the network component, wherein the correlation value is based on ownership correlation criteria of (i) administrator-type actions taken on the network component, (ii) high frequency of accessing the network component, (iii) high duration of accessing the network component, and (iv) a lack of other users that are associated with the network component. ### Claim 15 (depends on 10) The computer program product of claim 10, wherein the computer readable instructions further comprise instructions for: identifying vulnerability information for the vulnerability of the network component comprising at least a vulnerability classification, a remediation deadline, and a lifecycle of the vulnerability, wherein the notification of the vulnerability includes the vulnerability information. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein identifying the vulnerability information for the vulnerability of the network component comprises comparing the vulnerability to a vulnerability database to identify the vulnerability classification, the remediation deadline, and the lifecycle of the vulnerability. ### Claim 17 (depends on 10) The computer program product of claim 10, wherein the computer readable instructions further comprise instructions for: determining whether a remediation procedure has been initiated; and when the remediation procedure has not been initiated, transmitting a second notification to the computing device of the primary user; or when the remediation procedure has not been initiated, transmitting a request to the computing device of the primary for confirmation that the remediation procedure will be completed by a remediation deadline. ### Claim 18 (depends on 10) The computer program product of claim 10, wherein the computing device of the primary user is not the network component. ### Claim 19 A computer implemented method for network component owner identification and communication triggering, said computer implemented method comprising: providing a computing system comprising a computer processing device and a non-transitory computer readable medium, where the computer readable medium comprises configured computer program instruction code, such that when said instruction code is operated by said computer processing device, said computer processing device performs the following operations: monitoring a plurality of systems of record associated with a network of devices; identifying, from the monitored plurality of systems of record, a primary user of a network component; recording a linkage between the primary user, communication information for the primary user, and the network component in an ownership database; determining that a vulnerability of the network component is occurring; and in response to determining that the vulnerability of the network component is occurring, automatically transmitting a notification of the vulnerability to a computing device of the primary user. ### Claim 20 (depends on 10) The computer program product of claim 10, wherein identifying the primary user of the network component comprises: determining that the primary user cannot be identified in a primary system of record; determining that the primary user cannot be identified in secondary systems of record; analyzing network traffic to the network component to identify a plurality of users that have accessed the network component during a predetermined period of time; identifying, from the plurality of users, a first user that either (i) most recently accessed the network component or (ii) accessed the network component a greater number of times than any others of the plurality of users; and assigning the first user as the primary user of the network component.